Denial of Service Vulnerabilities in Scriban by Scriban

CVE-2026-74785

What is CVE-2026-74785?

Scriban versions prior to 7.0.0 exhibit multiple denial-of-service vulnerabilities due to flawed expression evaluation mechanisms. These vulnerabilities can be exploited through unbounded string multiplication, uncontrolled BigInteger shift operations, and by bypassing loop limits via range enumeration in built-in functions. Attackers who can deliver custom templates can create conditions that lead to out-of-memory exceptions or excessive CPU usage, potentially causing the host process to terminate unexpectedly.

References